>
> Hung Luu wrote:
> > Suppose I have the following DN's:
> >
> > inetOrgPerson:
> > [uid=alice,dc=example,dc=com]
> >
> > organizationalRole:
> > [cn=manager,ou=groups,dc=example,dc=com]
> > [cn=supervisor,ou=groups,dc=example,dc=com]
> >
> > locality:
> > [l=phoenix,ou=division,dc=example,dc=com]
> > [l=portland,ou=division,dc=example,dc=com]
> >
> > How can I store in my directory the fact that Alice is a manger at the
> > Phoenix division, but she is only a supervisor at the Portland
> division?
> > I know group membership is involved here, but what's the best way to
> > represent that group membership to optimize searches such as:
> Return all
> > the people with a specific role at a specific locality, or return all
> > the roles and localities for a person.
>
> You could also use slapo-memberof to populate the member entries with a
> back-reference to the group entries which make some queries a lot
> easier.
>

> Suppose I have a group of roles and a group of localities, so that I
> have the following representation of group membership:
>
> [cn=manager,ou=groups,dc=example,dc=com]
> member: uid=alice,ou=people,dc=example,dc=com
>
> [cn=supervisor,ou=groups,dc=example,dc=com]
> member: uid=alice,ou=people,dc=example,dc=com
>
> [l=phoenix,ou=divisions,dc=example,dc=com]
> member: uid=alice,ou=people,dc=example,dc=com
>
> [l=portland,ou=divisions,dc=example,dc=com]
> member: uid=alice,ou=people,dc=example,dc=com
>
> How will slapo-memberof tell me which role Alice has at which locality?
> What would the query look like?

Sorry, seems I mis-read your requirement. Off course you have to store the
relation in some kind of 2-tuple. You could create entries for the
organizational roles below the locations if that isn't too static.

Ciao, Michael.

No worries, Michael, I really appreciate your input (and everyone who has replied).

My
use cases dictate that every locality may have the same set of roles,
so do you see a better way to accomplish this other than duplicating
role entries under each locality?

The other thing I was contemplating was to flip group membership
around so that groups become members of a user, something like this: